Get size of the operand in bytes.

<summary> Get WOW64 TEB </summary> <param name="pteb">Process TEB</param> <returns>TEB pointer</returns>

<summary> Find pattern in kernel PE section </summary> <param name="section">Section name</param> <param name="pattern">Pattern data</param> <param na

Get compiler as `X86Compiler`.

Get function declaration as `X86FuncDecl`.

Get hint it (see `kVarHint)`.

Get the type of the memory operand, see `kMemType`.

Get preserved registers (mask). \note The result depends on the function calling convention used; the prototype of the function doesn't affect the ma

Get previous node in the compiler stream.

<summary> Get thread handle </summary> <returns>Thread hande</returns>

Get whether the variable was changed.

<summary> Call arbitrary function </summary> <param name="newThread">Perform call in a separate thread</param> <param name="pContext">Loader context</

<summary> Check if process is terminating </summary> <param name="imageBase">Process</param> <returns>If TRUE - terminating</returns>

<summary> Get exported function address </summary> <param name="pBase">Module base</param> <param name="name_ord">Function name or ordinal</param> <pa

<summary> Get module base address by name </summary> <param name="pProcess">Target process</param> <param name="ModuleName">Nodule name to search for<

<summary> Get WOW64 thread context </summary> <param name="ctx">Returned context</param> <param name="flags">Context flags.</param> <param name="dontS

<summary> Get symbol RVA </summary> <param name="symName">Symbol name</param> <param name="result">Resulting RVA</param> <returns>Status code</returns

Get stack size needed for function arguments passed on the stack.

Get memory operand index register code, variable id, or `kInvalidValue`.

Get variable liveness bits.

Get variable type name.

Get memory operand index scale (0, 1, 2 or 3).

Get VarAttr at `index`.

<summary> Get thread ID </summary> <returns>Thread ID</returns>

Get whether the register is Gp qword (64-bit) register.

Get whether the operand is a register - `kOperandTypeReg`.

Set whether the variable was changed.

<summary> Get raw data size </summary> <returns></returns>

Get `O` field of `opCode`.

<summary> Create new process and attach to it </summary> <param name="path">Executable path</param> <param name="suspended">Leave process in suspended

<summary> Get ntoskrnl base address </summary> <param name="pSize">Size of module</param> <returns>Found address, NULL if not found</returns>

<summary> Terminate process </summary> <param name="code">Exit code</param> <returns>Stratus code</returns>

Append `str` of `len`.

Get argument at index `id`.

Get memory operand relative displacement.

Get the current offset in the buffer.

Get register type.

Get whether the variable is Gpb (8-bit) register.

<summary> Create environment for future remote procedure calls _userData layout (x86/x64): ----------------------------------------------------------

<summary> Remove module from module list </summary> <param name="filename">Module file name</param> <param name="mt">Module type. 32 bit or 64 bit</pa

<summary> Set WOW64 thread context </summary> <param name="ctx">Context to set</param> <param name="dontSuspend">true if thread shouldn't be suspended

Create a dummy Gp register.

Get aligned stack size used by variables and memory allocated on the stack.

Get context variable id (used only by `Context)`.

Get data.

Get instruction name string (null terminated).

Get state as `X86VarState`.

Get whether the operand is an immediate value - `kOperandTypeImm`.

<summary> Reset local data </summary>

Set the input register index.

Set register index.

<summary> Try to free memory and reset pointers </summary>

<summary> Allocate virtual memory </summary> <param name="lpAddress">Allocation address</param> <param name="dwSize">Region size</param> <param name="

<summary> Query virtual memory </summary> <param name="lpAddress">Address to query</param> <param name="lpBuffer">Retrieved memory info</param> <retur

Get compiler instruction item size without operands assigned.

Append `i`.

Get stack size needed to align stack back to the nature alignment.

Get end of the current scope.

Get current function as `X86FuncNode`. This method can be called within `addFunc()` and `endFunc()` block to get current function you are working wit

Get variable id.

Get options of the next instruction and reset them.

Get target label.

Get operands count.

\internal Get `VarData` by `id`.

Get whether the instruction has flag `flag`, see `kX86InstFlags`.

Get whether the node has beed fetched.

Get whether the variable has been initialized by `Compiler`.

Get whether the register is Mm (64-bit) register.

Set the output register index.

Getting `VarClass` is the only safe operation when dealing with denormalized `varType`. Any other property would require to map vType to the architect

<summary> Add hardware breakpoint to thread </summary> <param name="addr">Breakpoint address</param> <param name="type">Breakpoint type(read/write/exe

<summary> Unmap all regions, delete MDLs, close handles, remove entry from table </summary> <param name="pProcessEntry">Process entry</param>

<summary> Find VAD that describes target address </summary> <param name="pProcess">Target process object</param> <param name="address">Address to find

<summary> Change VAD protection flags </summary> <param name="pProcess">Target process object</param> <param name="address">Target address</param> <pa

<summary> Get file name from full path </summary> <param name="path">Path.</param> <param name="name">Resulting name</param> <returns>Status code</ret